Bug bounty program
MG
MTN Group
Most upvoted reports128
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection on cookie parameterAnalysed#761304 | SQL Injection | 2020-05-03 | – | 323 |
| SQLi | in URL pathsAnalysed#2958619 | SQL Injection | 2025-03-06 | – | 149 |
| IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage.Analysed#1773609 | Insecure Direct Object Reference | 2024-10-05 | – | 135 |
| Yet Another OTP code Leaked in the API ResponseAnalysed#2635315 | Authentication | 2025-01-08 | – | 135 |
| FULL ACCOUNT TAKEOVERAnalysed#2542372 | No weakness recorded | 2024-08-17 | – | 123 |
| SQL injection in URL path leads to Database AccessAnalysed#2633959 | SQL Injection | 2025-01-08 | – | 115 |
| Authentication Bypass Leads To Complete Account TakeveOver on ██████████Analysed#1709881 | Authentication | 2024-09-14 | – | 109 |
| DOM Based Reflected Cross Site ScriptingAnalysed#2321874 | Cross-site Scripting | 2024-12-25 | – | 104 |
| Reflected cross site scripting (XSS) attacks Reflected XSS attacks,Analysed#1799197 | Cross-site Scripting | 2024-08-30 | – | 100 |
| Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Analysed#2762462 | Authentication | 2025-03-04 | – | 98 |
Subdomains214,285
| Name | Scope | First seen |
|---|---|---|
| api-dev.lonestarcell.comapi, dev | Not in the scope | 2026-11-14 |
| cms-dev.lonestarcell.comadmin, dev | Not in the scope | 2026-11-14 |
| www.api-dev.lonestarcell.comapi, dev | Not in the scope | 2026-11-14 |
| www.cms-dev.lonestarcell.comadmin, dev | Not in the scope | 2026-11-14 |
| dev-shop.mtn.cmdev | Not in the scope | 2026-11-14 |
| backend-dev-shop.mtn.cmdev | Not in the scope | 2026-11-14 |
| help-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| nginx-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| consul-dev-my.mtn.co.rwdev, tools | Not in the scope | 2026-11-14 |
| mtn-id-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| balances-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| products-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| profiles-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| analytics-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| notification-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| subscription-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| config-management-dev-my.mtn.co.rwadmin, dev | Not in the scope | 2026-11-14 |
| localhost.mtn.co.szdev | Not in the scope | 2026-11-14 |
| dev.mtn.co.zadev | Not in the scope | 2026-11-14 |
| dev.auth.mtn.co.zaauth, dev | Not in the scope | 2026-11-14 |
| localhost.mtn.co.zadev | Not in the scope | 2026-11-14 |
| tfls-gis-dev.mtn.co.zadev | Not in the scope | 2026-11-14 |
| dev.onlinecms.mtn.co.zadev | Not in the scope | 2026-11-14 |
| smartvillage-dev.mtn.co.zadev | Not in the scope | 2026-11-14 |
| chatbot.ols-ygb-dev-san.mtn.co.zadev | Not in the scope | 2026-11-14 |
| dev.mtn.comdev | Not in the scope | 2026-11-14 |
| atlas-dev.mtn.comdev | Not in the scope | 2026-11-14 |
| kente-dev.mtn.comdev | Not in the scope | 2026-11-14 |
| heymtn-dev.mtn.comdev | Not in the scope | 2026-11-14 |
| otp-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| blob-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| crbt-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| help-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| mykente-dev.mtn.comdev | Not in the scope | 2026-11-14 |
| dev.mtnid.za.mtn.comdev | Not in the scope | 2026-11-14 |
| kentedxp-dev.mtn.comdev | Not in the scope | 2026-11-14 |
| mtnid-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| portal.local.mtn.comdev | Not in the scope | 2026-11-14 |
| cdn-sa-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| gamifyhub-dev.mtn.comdev | Not in the scope | 2026-11-14 |
| mtnonecdn-dev.mtn.comdev | Not in the scope | 2026-11-14 |
| mtnonedxp-dev.mtn.comdev | Not in the scope | 2026-11-14 |
| pms-ui-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| promos-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| cae-dev02.tcoe.mtn.comdev | Not in the scope | 2026-11-14 |
| dev.developers.mtn.comdev | Not in the scope | 2026-11-14 |
| profile-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| rewards-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| accounts-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| balances-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| cimtnonedxp-dev.mtn.comdev | Not in the scope | 2026-11-14 |
| dev-nigeria.api.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| grpc.cli-dev.my.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| grpc.ser-dev.my.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| products-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| kente-market-dev.mtn.comdev | Not in the scope | 2026-11-14 |
| auth.dev.mtnid.za.mtn.comauth, dev | Not in the scope | 2026-11-14 |
| profile-sa-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| accounts-sa-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| exp-manager-dev.my.mtn.comadmin, dev | Not in the scope | 2026-11-14 |
| products-sa-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| dev-appx.developers.mtn.comdev | In scope | 2026-11-14 |
| dev.northeurope.api.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| notification-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| subscription-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| analytics-api-dev.my.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| config-dev-latest.my.mtn.comdev | Not in the scope | 2026-11-14 |
| analytics-service-dev.my.mtn.comdev | Not in the scope | 2026-11-14 |
| argocd.dev.northeurope.api.mtn.comapi, ci, dev | Not in the scope | 2026-11-14 |
| dev.preprod.westeurope.api.mtn.comapi, dev, staging | Not in the scope | 2026-11-14 |
| wildcard.dev.preprod.westeurope.api.mtn.comapi, dev, staging | Not in the scope | 2026-11-14 |
| dev-za.preprod-za.southafricanorth.api.mtn.comapi, dev, staging | Not in the scope | 2026-11-14 |
| prod-agg-v2-madapi-dev.apps.prod01.rwa.api.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| subs-agg-v1-madapi-dev.apps.prod01.rwa.api.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| rabbitmq-dev-madapi-dev.apps.prod01.rwa.api.mtn.comapi, data, dev | Not in the scope | 2026-11-14 |
| backigee-mg-dev.apps.cluster-01.az-euwest.api.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| wildcard.dev-za.preprod-za.southafricanorth.api.mtn.comapi, dev, staging | Not in the scope | 2026-11-14 |
| pulse-dev.mtn.com.ghdev | Not in the scope | 2026-11-14 |
| chatbot-dev.mtn.com.ghdev | Not in the scope | 2026-11-14 |
| mtnoneapp-dev.mtn.com.ghdev | Not in the scope | 2026-11-14 |
| mtnonecms-dev.mtn.com.ghdev | Not in the scope | 2026-11-14 |
| mtnonedxp-dev.mtn.com.ghdev | Not in the scope | 2026-11-14 |
| mtnoneapis-dev.mtn.com.ghdev | Not in the scope | 2026-11-14 |
| zigi-dev.mtn.sddev | Not in the scope | 2026-11-14 |
| dev.chezapay.mtn.zmdev | Not in the scope | 2026-11-14 |
| testewp-dev.mtncameroon.netdev | Not in the scope | 2026-11-14 |
| www.testewp-dev.mtncameroon.netdev | Not in the scope | 2026-11-14 |
| dev.mtnfootball.comdev | Listed out of scope | 2026-11-14 |
| localhost.mtnselfcare.co.zmdev | Not in the scope | 2026-11-14 |
| localhost.mtnzambia.co.zmdev | Not in the scope | 2026-11-14 |
28 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.